Skt NURCaptcha Security & Risk Analysis

The skt-nurcaptcha v3.6.0 plugin presents a mixed security posture. While the static analysis indicates a minimal attack surface with no apparent AJAX handlers, REST API routes, shortcodes, or cron events exposed without authentication, several concerning code signals warrant attention. The plugin performs SQL queries without prepared statements, and a significant portion of its output is not properly escaped, creating potential risks for data manipulation and cross-site scripting (XSS) vulnerabilities.

The taint analysis reveals flows with unsanitized paths, although thankfully no critical or high severity issues were identified in this version. The vulnerability history shows a past medium severity CVE, which was a Cross-Site Request Forgery (CSRF). The fact that this CVE is no longer unpatched is positive, but the recurrence of CSRF suggests a potential pattern of insecure handling of user actions.

Overall, the plugin has strengths in its limited attack surface, but weaknesses in its handling of SQL and output escaping, alongside historical patterns of CSRF, indicate areas where developers should focus on improving security practices. Proactive patching of historical vulnerabilities is good, but the underlying code quality needs enhancement.